ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the PureRAT remote access trojan by monitoring for specific indicators of compromise such as malicious file hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical to identify early-stage infections that could lead to persistent lateral movement and data exfiltration within the enterprise environment.

IOC Summary

Malware Family: PureRAT Total IOCs: 8 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["65.1.70.222", "209.99.190.23", "125.62.77.141", "172.236.157.30", "172.111.198.212", "91.92.40.209", "64.95.13.219"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["65.1.70.222", "209.99.190.23", "125.62.77.141", "172.236.157.30", "172.111.198.212", "91.92.40.209", "64.95.13.219"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - PureRAT
let malicious_domains = dynamic(["brahmalihvc.online"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Software Deployment via SCCM/Intune

  • Context: The IT team uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy a new version of the “PureRAT” remote management agent or a related utility to endpoints. This deployment process generates network traffic and file hashes that match the PureRAT IOCs.
  • Filter/Exclusion: Exclude alerts where the source process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe, and the destination IP belongs to the internal corporate management subnet (e.g., 10.x.x.x).

• Scenario: Scheduled Maintenance by RMM Tools

  • Context: An enterprise Remote Monitoring and Management (RMM) tool, such as ConnectWise Automate or Datto RMM, runs a nightly scheduled job to update agent configurations. These agents often share similar telemetry signatures with PureRAT, triggering the detection during the maintenance window (e.g., 02:00 – 04:00 UTC).
  • Filter/Exclusion: Create an exclusion for alerts occurring between 01:00 and 05:00 local time on endpoints where the parent process is cwagent.exe or datto-agent.exe.

• Scenario: Internal Security Scanning by EDR

  • Context: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or SentinelOne, performs a scheduled “threat hunt” scan. During this scan, the EDR engine queries internal repositories that host PureRAT signature definitions, causing network connections to IOCs that mimic the PureRAT behavior